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Decoded prop^^P 
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1 — ^ 

o 


Collect profile ^ ^ 
trace-packets? 


«# 


> 


I-TLB 
property bi 




'0 
uW 


u 
u 

2 
& 


>)' Interpretation 

i 
1 

1 


Instructions sei 


Probe for 
translated cot 


I/O memor}) 
reference 
exceptions 


00 


Tap 


Tap 


no 


Native code observing native 


Native 
decoder 


No 


No 


Fault 
if SEG.tio 


01 


Tap 


x86 


no 


Native code observing x86 

pnllino pnnvpnfirtnc 
wuiiiii^ ^Ull vcilUUIla 


Native 
decoder 


No 


No 


Fault 
if SEG.tio 


10 


x86 


x86 


no 


x86 code, unprotected - 
TAX! profile collection only 


x86HW 
converter 


If enabled 


No 


Trap 
if profiling 


11 


x86 


x86 ' 


yes 


x86 code, protected - 
TAX! code may be available 


x86HW 
converter 


If enabled 


Based on I- 
TLB probe 
attributes 


Trap 
if profiling 



ia4 
1^ 



.'Significance of the I-TLB property bits 



2.2. H-x 




jlSA & CC transition exception flow 



J 



name 


description 


type 


VECT_call_X86_CC 


push args, return address, set up x86 state 


fault on target instruction 


VECTJump_X86_CC 


set up x86 state 


fault on target instruction 


' VECT_ret_no Jp_X86_CC 


return value to eax:edx, set up x86 state 


fault on target instruction 


VECT.ret_fp_X86_CC 


return value to x86 fp stack, set up x86 state 


fault on target instruction 


VECT,call_TAP_CC 


x86 stack args, return address to registers 


fault on target instruction 


VECTJump_TAP_CC 


x86 stack args to registers 


fault on target instruction 


VECT_ret_no_fp_TAP_CC 


return value to RVO 


fault on target instruction 


VECT_rct_any_TAP_CC 


return type unknown, setup RVO and RVDP 


fault on target instruction 





ISA & CC property values 


Handler Action 


00=>00 


No transition exception 


00 =>01 


VECT_xxx_X86_CC exception - handler converts from native to x86 conventions 


00 => Ix 


VECT_xxx_X86_CC exception - handler converts from native to x86 conventions, 

sets up expected emulator and profiling state 


01 => 00 


VECT_xxx_TAP_CC exception - handler converts from x86 to native conventions 


01 =>01 


No transition exception 


01 => Ix 


VECT.X86JSA exception [conditional based on PCW.X86_ISA_ENABLE flag] 
- sets up expected emulator and profiling state 


lx=> 00 


VECT_xxx_TAP_CC exception - handler converts from x86 to native conventions 


lx=>01 


VECT„TAPJSA exception [conditional based PCW.TAP_ISA_ENABLE flag] 
- no convention conversion necessary 


lx=>10 


No transition exception - [profile complete possible, probe possible] 


lx=>ll 


No transition exception - [profile complete possible, probe NOT possible] 



r 



Flat 32-bit "Near" Address Space 



x86? RISC? 



Transparency: 

. x86 code adheres to traditional 

x86 stack-based conventions 
. RISC uses higher perfomnance 

register-based conventions 
. Caller has no knowledge 

of callee's ISA 
. Callee has no knowledge 

of ISA to which it will return 




Flat 32-bit "Near" Address Space 





5 ./ \ • W 


'^xS6 RISC transition: 
% map x86 call to RISC 

32'2L C<=':3-3K)j 


RISC -> x86 transition: 
map x86 returp to RISC 


no ISA transition: 
no mapping required 

1 J 
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Flat 32-bit "Near" Address Space 



x86 



RISC' 



1— RISC — 1 




RISC^ x86 transition: 
map RISC call to x86 
3HO \ ^\^. 3>'0 



x86-^ RISC transition: 
map RISC return to x86 



no ISA transition: 
no mapping required 



406036_1 



Flat 32-bit "Near" Address Space 




^•^86 RISC transition: 
^;piap RISC return to x86 

^2_f>, 332 (R*,.3^^) ' 



RISC x86 transition: 
map RISC call to x86 



no ISA transition: 
no mapping required 
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a 

m 
in 



Flat 32-bit "Near" Address Space 



call.?' 



RISC 



I — RISC — I 




I 



RISC ^ x86 transition: 
map x86 return to RISC 



x86-> RISC transition: 
map x86 call to RISC 

B22 (F\»j. 3w;) 



no ISA transition: 
no mapping required 



F,3. 3f 
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x86 Preamble: 
(need not be inline) 



- Load register args 

- Fill-in RXA (return transfer argument area) 



GeneraLEntry: 



YES 



3\7 



XD == 0? 



Native Entry: - 

NativePreamble: 

(typically vacuous) 



NO 



3»© 



- Varargs 

- AP for a very big argument list 



v! omit if \ 



Function Body: 



. I 



setupXD: 

XD <r- <descriptor__constant> 

RET 



m 



X86-to-Tapestry transition exception handler ^ 

// This handler is entered under the following conditions: 
// 1. An x86 caller invokes a native function 
// 2. An x86 function returns to a native caller 

// 3. x86 software returns to or resumes an interrupted native function following 
// an external asynchronous interrupt, a processor exception, or a context switch 

dispatch on the two least-significant bits of the destination address { 
case "00" // calling a native subprogram 

// copy linkage and stack frame information and call parameters from the memory 

// stack to the analogous Tapestry registers 

LR <- [SP-H-] // set up linkage register ^ 32--i \ 
AP ^ SP // address of first argument ^ 32^ 

SP <- SP - 8 // allocate return transfer argument area 351^ 

SP ^ SP & (-32) // round the stack pointer down to a 0 mode 32 boundary 32-7 
XD <- 0 // inform callee that caller uses X86 calling conventions ^ 328 

n case "01" // resuming an X86 thread suspended during execution of a native routine " 

y3 if the redundant copies of the save slot number in EAX and EDX do not match or if 37 # 
y the redundant copies of the timestamp in EBX:ECX and ESLEDI do not match { j 

L J // some form of bug or thread corruption has been detected 

£3 goto TAPESTRY_CRASH_S YSTEM( thread-corruption-error-code ) ^ 37 ^ 

y \ save the EBX:ECX timestamp in a 64-bit exception handler temporary register 7 <a V S?^ 

ry (this will not be overwritten during restoration of the full native context) 3 

use save slot number in EAX to locate actual save slot storage 374* 

restore fiill entire native context (includes new values for all x86 registers) -~375 
if save slot's timestamp does not match the saved timestamp { --w 37 
f"^ // save slot as been reallocated; save slot exhaustion has been detected 

^: goto TAPESTRY_CRASH_S YSTEM( save-slot-overwritten-error-code ) '-^ 37 7 

free the save slot ^ 376 ^ 

case "10" // returning from X86 callee to native caller, result already in registers 

RV0<63 :32> <- edx<3 1 :00> // in case result is 64 bits 3^ ^ I 332. 

convert the FP top-of-stack value from 80 bit X86 form to 64-bit form in RVDP "^M J 
SP^-ESI //restores? from time of call ^'h'bl J 

case "11" // returning from X86 callee to native caller, load large result from memory "7 

RV0..RV3 <- load 32 bytes from [ESI-32] // (guaranteed naturally aligned) ^ •2>3o { Z23 
SP <- ESI // restore SP from time of call — 3^ 7 J 

} 

EPC <- EPC & -4 // reset the two low-order bits to zero ^ "^bh 



Fig. 3h 
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Tapestry-to-X86 transition exception handler 

// This handler is entered under the following conditions: 
// 1. a native caller invokes an x86 function 
// 2. a native function returns to an x86 caller 
switch on XD<3:0> { 3*Vl- 

XD_RET_FP; // result type is floating point 

FO/Fl <r- FINFLATE.de( RVDP ) // X86 FP resuUs are 80 bits 
SP <- from RXA save // discard RXA, pad, args 

FPCW 4r- image after FINIT & push // FP stack has 1 entry 
goto EXIT 



Id 



XD_RET_WRITEBACK: // store result to @RVA, leave RVA in eax 

RVA <- from RXA save // address of result area 

copy decode(XD<8:4>) bytes from RV0..RV3 to [RVA] 
eax <- RVA // X86 expects RVA in eax 

SP <r- from RXA save // discard RXA, pad, args 

FPCW <r- image after FINIT // FP stack is empty 

goto EXIT 

XD_RET_SCALAR: // result in eax:eda 

edx<3 1 :00> <- eax<63 :32> // in case result is 64 bits 

SP <- from RXA save // discard RXA, pad, args 

FPCW <- image after FINIT // FP stack is empty 

goto EXIT y 



XD_CALL_HIDDEN_TEMP: // allocate 32 byte aligned hidden temp 

esi <- SP // stack cut back on return ^ 3*^*3 

SP <- SP - 32 // allocate max size temp 344 

RVA <- SP // RVA consumed later by RR 3 

LR<1 :0> <r- "1 1" // flag address for return & reload ^ 345 

goto CALL_COMMON 



default: 

esi 4r- SP 

LR<1:0><-"10" 
CALL_COMMON: 

interpret XD to push and/or reposition args 34-7 
[~SP] LR // push LR as return address 



// remaining XD_CALL_xxx encodings 

// stack cut back on return ~ 34-^ 
// flag address for return 



EXIT: 



} 

RFE 



setup emulator context and profiling ring buffer pointer 



} 



// to original target 



Fig. 31 
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interrupt/exception handler of Tapestry operating system: ^ 

II Control vectors here when a synchronous exception or asynchronous interrupt is to be 
// exported to / manifested in an x86 machine. 

// The interrupt is directed to something within the virtual X86, and thus there is a possibility 
// that the X86 operating system will context switch. So we need to distinguish two cases: 
// either the running process has only X86 state that is relevant to save, or 
// there is extended state that must be saved and associated with the current machine context 
// (e.g., extended state in a Tapestry library call in behalf of a process managed by X86 OS) 
if execution was interrupted in the converter - EPC.ISA = X86 { 

// no dependence on extended/native state possible hence no need to save any r 3^1. 
goto EM86_Deliver_Interrupt( interrupt-byte ) J 

} else if EPC.Taxi_Active { 

// A Taxi translated version of some X86 code was running. Taxi will rollback to an 
// x86 instruction boundary. Then, if the rollback was induced by an asynchronous external 
// interrupt Taxi will deliver the appropriate x86 interrupt." Else, the rollback was induced 
// by a synchronous event so Taxi will resume execution in the converter, retriggering the 
// exception but this time will EPC.ISA = X86 
IJ'i goto TAXi_Rollback( asynchronous-flag, interrupt-byte ) 

pise if EPC.EM86 { ^ 



35-% 



in 



\ else { 



// The emulator has been interrupted. In theory the emulator is coded to allow for such \ ^c, 
// conditions and permits re-entry during long running routines (e.g. far call through a gate) 
// to deliver external interrupts 
goto EM86_Deliver_Interrupt( interrupt-byte ) 



II This is the most difficult case - the machine was executing native Tapestry code on 
// behalf of an X86 thread. The X86 operating system may context switch. We must save 
// all native state and be able to locate it again when the x86 thread is resumed. 

allocate a fi-ee save slot; if unavailable firee the save slot with oldest timestamp and try agam 

save the entire native state (both the X86 and the extended state) "2 "Z. 

save the X86 EIP in the save slot 3 

overwrite the two low-order bits of EPC with "01" (will become X86 interrupt EIP) ^ 3^3 

store the 64-bit timestamp in the save slot, in the X86 EBX:ECX register pair (and, 7 ^^i^ 

for further security, store a redundant copy in the X86 ESLEDI register pair) O 
store the a number of the allocated save slot in the X86 EAX register (and, again for 2 0x^5 

further security, store a redundant copy in the X86 EDX register) S 
goto EM86_DeUver_Interrupt( interrupt-byte ) --v- ^q<^ 



350 
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typedef struct { 
save_slot_t * 
save_slot_t * 
unsigned int64 
unsigned int64 
unsigned int64 

timestamp_t 
int 

boolean 
} save_slot_t; 



newer; 
older; 
epc; 
pew; 

registers[63]; 
timestamp; 



379 c. 



// pointer to next-most-recently-allocated save slot 7 
// pointer to next-older save slot ^ 
// saved exception PC/EP 

// saved exception PCW (program control word) L 354* 
// save the 63 writeable general registers 
// other words of Tapestry context 



// timestamp to detect buffer overrun 
save_slot__ID; // ID number of the save slot ~ 3^7 
save_slot_is_full; // full / empty flag 3&9 





save_slot_t * save_slot_head; // pointer to the head of the queue --^ 3*7^ a. 

save_slot_t * save_slot_tail; // pointer to the tail of the queue ^ "s^-p g) t> 



s^item initialization 

Lj reserve several pages of unpaged memory for save slots 

P 



ry Fig. 3k 

s 



406036_1 



t 32-bit "Near" Addres^njace 



< 




- Handler: RISC to x86 — 

XD contains retum-descripton 



342 



. Interpret XD: 

- Reformat / repostion result 

- Load FPCW 

. SP <r- [SP] // pop RA & args^K 



XD contains call-descriDtor: 



ESI <- SP 

Interpret XD. reposition args 
LR<1:0><- IxperXD 
Pusli LR as RA (ret addr) 



ii 

/ I 



I 



\ 
\ 

\ 



. x86 regs points to save slot 
. Using TS verify no overwrite 
. Restore full state 
. Free save slot 
. EPC<1:0> <- 00 



EPC<1:0> = 1x: ^ 



Reformat / repostion the 
function result per EPC<0> 
SP 4- ESI 
EPC<1:0><- 00 



I I 



i I 

I 



/ 

w 

in 
ru 

1== 
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r 



Flat 32-bit "Near" Address Space 




. — RISC — . 
So6 



317," 
x86 preamble 

xd <- ret-desc 




32P 



— Handler: RISC to x86 — 

XD contains return-descriptor: 



Interpret XD: 

- Reformat / repostlon result 

- Load FPSW 



SP <- [SP] // pop RA & argsi ^ 




j/ 

II 



Handler: x86 to RISC 



EPC<1:0> = 00: 



322 



LR<- [SP] 
SP<- SP + 4 
AP <- SP 
SP <- SP - 8 
SP <- SP & (-32) 
XD<- 0 




Flat 32-bit "Near" Address Space 




Initiate x86 excep. or int. - 

. Alloc free or oldest save slo 
. Store timestamp & full state 
. x86 regs<- save slot ID, TS 
. EPC<1:0><- 01 




302^304 



% 
I 
I 

% 

% 




Handler: x8P p's^ 



EPC<1:0> = 01: 
. x86 regs points to save slot 
. Using TS verily no ovenA/rite 
. Restore full state 
. Free save slot 
.EPC<1:0><-00 ^1? 



'i 



Flat 32-bit "Near" Address Space 
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7 entry trace packet 



Entry 


Event Code 


DoneAddr |NextAddr 




64 bit time stamp 


1 


ret 


x86 context 


physX:f 


2 


new paae 




physY:h 


3 


jcx: forward 


phvs Y:i 


phvs Y:k 


4 


jnz badcward 


phvsY:! 


physX:a 


5 


seq; env chanqe 


x86 context 


physX:b 


6 


ip-rel near call 


phvsX:c 


physZ.d 


7 


near ret 


physZ:e 


physX:f 



C-^ ^^iz 







acket 


event 


01 


w 

2 


a 

'■a 


es 


'2 


O 
b 








! 

c 



r 



Code 



0.0000 



0.0001 



0.0010 



0.0011 



0.0100 



0.0101 



0.0110 



0.0111 



0.1000 



0.1001 



0.1010 



0.1011 



0.1100 



0.1101 



0.1110 



0.1111 



Event 



Default (x86 transparent) event, reuse all converter values 



Simple x86 instruction completion (reuse event code) 



Probe exception failed 



Probe exception failed, reload probe timer 



,f Iu'aVv ev«v^ no 



Sequential; execution environment changed - f o rcje. e>^c*<*" 



Far RET 



IRET 



Far C All- 



Far JMP 



Special; emulator execution, supply extra instruction data'' 



Abort profile collection 



x86 synchronous/asynchronous interrupt w/probe (GRP 0) 



x86 synchronous/asynchronous interrupt (GRP 0) 



x86 synchronous/asynchronous interrupt w/probe (GRP 1) 



x86 synchronous/asynchronous interrupt (GRP 1) 



o 
u 



3 



a 



I 9 

s E g 

? « - 

^ ^ u a 

« e 1 



yes 



yes 



yes 



yes 



no 



no 



no 



no 



no 



no 



no 



no 



yes 



yes 



yes 



yes 



yes 



yes 



no 



yes 



yes 



yes 



yes 



no 



no 



yes 



no 



yes 



yes 



no 



no 



yes 



yes 



yes 



yes 



no 



no 



no 



no 



yes 



no 



no 



yes 



yes 



Far call 



Emulator probe 



Emulator probe 



^ 



1.0000 



1.0001 



1.0010 



1.0011 



1.0100 



1.0101 



1.0110 



1.0111 



1.1000 



1.1001 



1.1010 



1.1011 



IP-relative JNZ forward (opcode: 75, OF 85) 



no 



yes 



yes 



IP-relative JNZ backward (opcode: 75. OF 85) 



yes 



yes 



yes 



Jnz 



IP-relative conditional jump forward - (Jcc, Jcxz, loop) 



no 



yes 



yes 



IP-relative conditional jump backward - (Jcc, Jcxz, loop) 



no 



yes 



yes 



yes 



Cond jump 



IP-relative, near JMP forward (opcode: E9, EB) 



no 



yes 



yes 



IP-relative, near JMP backward (opcode: E9, EB) 



yes 



yes 



yes 



Near jump 



RET/ RET inunl6 (opcode C3. C2 /w) 



no 



yes 



yes 



no 



IP-relative, near CALL (opcode: E8) 



no 



yes 



yes 



yes 



Near call 



REPE/REPNE CMPS/SCAS (opcode: A6, A7, AE. AF) 



no 



yes 



no 



no 



REP MOVS/STOS/LDOS (opcode: A4, A5, AA, AB, AC, AD) 



no 



yes 



no 



no 



Indirect near JMP (opcode: FF /4) 



no 



yes 



yes 



no 



Indirect near CALL (opcode: FF /2) 



no 



yes 



yes 



yes 



Near call 



1 . 1 100 load from I/O memory (TLB.asi != 0) { not used in Tl } 
1.1110 Default converter event; sequential 



no 



yes 



no 



no 



1.1111 



I y\t> v\e> no no 



New page (instruction ends on last byte of a page frame or 
straddles across a page frame boundary) 4$S 



no 


no 


no 


no 




no 


yes 


no 


no 





a. Used by emulator for new x86 opcodes. Extra information supplied in TaxijControlspecialjopcode bits. 



F.3 .4-ti 



TIT? 

: : 1 
•^•^ 

Tier 




Co 

1 fi 




ry 




h 




■ 









f 
\ 



LL- 
I 

O- 

■o 

3 
0) 
(0-1 
Q. 



I- 



tuuis 



|e9J 



98A 



zad 



zud 



OSQO 



tSQO 



0SI.O 



o 
o 
o 
o 



CO CM 

coco 
co^ 
coin 

CO CD 

cor^ 

CO 00 
COCb 

^co 

mo 

incM 
toco 

mm 
mcD 
mh- 
mco 
mo> 

CDO 
CDt- 
flDCM 

coco 



o. 



(0 



0) 



IH 

(DH 

E 

CD 



0 
C3> 

Q. 

©- 

m 

CO 
LL 

• • 

<D-| 



OO 

OCM 
OCO 

om 

OCO 

ooo 
<Da> 
o 

T-CO 

T-m 

CMO 
CMi- 
CM04 
CM CO 
CM^ 

CMm 

CMO 

CMr^ 

CM CO 
CMC3> 

coo 

COT- 



I 



t 
s 

i 



o 

0)' 



(0 
t_ 

LL 

0) 

CI 

o 
Q 



E 

s 

U— I 
0) 

03 
Q. 

CD' 



CO 
CO 



0) 

c 
o 

QJ 



• • CD 

O J 
0«Sr 



COCM 

coco 
co^ 
com 
coco 

COh* 

coco 

C0C3& 

^o 

'O'CM 
^CO 

^m 

^co 
rta> 
mo 
mr- 
mcM 
mco 
m^ 
mm 
m<D 
mh- 
mco 
mod 
coo 

CDt- 
<DCM 
40 CO 




o. 

>. 

CO. 

CO 

llL 

1^ 



E 

s 

L1-- 

<D_ 

CDJ 

a. 

CD- 
'S:. 

CQ 



Li. 



CD-| 



if* 
8'4 



OO 
Ot- 
OCM 
OCO 
O^ 

om 

0(0 

or^ 

OCO 
OCft 

T-O 

T-CM 
T-CO 

T-m 

T-flO 

T-CO 
T-O* 

CMO 
CMt- 
CMCM 
CM CO 
CM^ 

CMm 

CM CO 
CMI^ 
CM CO 
CMO 
COO 
COt- 



I- 

I 
I 




ON 



• 



^ 



0) 



$ CO 

ill 



1- 



O 
Q. 



CO 

o 

(0 



0) 

(0-1 

CO 



UiUIS 



|eaj 



99A 



zad 



2ud 



OSQO 



idun 



jojd 



eqojd 



CO CM 

coco 
co^ 
com 

CO CD 
COI^ 

coco 
coo 

CO 

too 

lOCNI 
lOCO 

totn 

lO(D 

moo 
ma> 
<bo 

<D^- 
(OCM 

coco 



iS 
o 

O-J 
I 

ca 
o- 

a> 

o 

E' 

:^ 

S" 

CL- 



M 

O' 

CO 

o 
E 

S 



OO 
O*- 
OCN 
OCO 

om 

0(D 
OCO 

oo> 

1-CN 
-t-CO 

^m 

MO 
OJ't- 
<NCN 
CM CO 
CN^ 

oim 

CMh- 
CM 00 
CMO) 

coo 

COt- 



"I 



ON 



Ik 

r 

I' 
I 



a. 

(f 



Ob 



OO. 



0 



0 

^0 



O 



PIP 



1 

c 

liJ 



bajd 



CO — 



s. 

Q. 




s 



ped 



OO 
Ot- 
OCM 
OCO 
O^ 
OU> 
OO 

or^ 

OCO 

oa> 

T-O 
T— ^ 

^CM 
i-CO 
T-^ 

T-m 

1-CO 

^o 

CMO 
CM^ 
CM CM 
CM CO 
CM^ 
Olio 
CM CO 
CMh- 
CM CO 
CMO) 
COO 
COt- 



50 

Si 

i 

a. 



0) 

E 
o 



OA 

E 

O 

0. 



00 

Ot- 
OCM 
OCO 

o-^ 
oin 

OCO 

or^ 
000 
00 
^o 

▼-■^ 

^CM 
n-CO 

t-<D 

^€0 
y-0> 
CMO 
CM^- 
CMCM 
CM CO 
CM^ 
CM in 
CM CD 
CMh- 
CM CO 
CM CD 
COO 
CO^ 



I 



A i 

VA CuS ca 




taxi profile entry generation 



Taxl_State 

3Se 



x86 instruction decode 



converter event code 



inst straddles or ends on a page boundary 



unconditional/non control transfer 



576 




last converter 
recipe instruction 
completes 
from W stage 



to W stage to update 
Event Code Latch 




pez. 

_ pes.! 
snnrn 



Event code from RFE restarting converter previous converter cycle 

or mapping of converter's x86 opcode i\r c wi pi c 



^ _. ' ! 1 Use latched 
Event Code LatClK^ (rf^ event code 



RFE Event 
Decode 



Clear Taxi__Stat e.pact 



Probe failed RFE 
► 



Probe timer reload 
► 



r 



(V724 



f3 



Next (v/s target) 
page properties 
from l-TLB 



I 



Table 3 



E 

UJ 



Event Code _ 

CO CO c 
0) 0) o 

z z o 



J 

SJ 



CO 

u. 



0 



Next instruction cycie 



Initiate Packet ^i8> 
► 



Profileable Event 4 It:* 



Probeable Event folo 
► 



I — Taxi_ControL probe 
^ l-TLB protected 

page property 



oOuOOO 



^70 




G76 



_ TAX/ enabled 

for current x86 context 

r- TaxLState.pact^^'^ 
Probe! 




Decoded_Probe_Event < 



L 



ceo 



Probe_Mask 



Probe failed RFE: 



Clear corresponding Decoded_Probe_Event bit 

Probe timer reload 



Timer expired: 



Set ALL probe mask bits 



Probe timer 
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